chore(release): 5.2.7 — consolidate PRs #744-#750 from 5.2.6

.aiox-core/install-manifest.yaml

@@ -7,8 +7,8 @@
 # - SHA256 hashes for change detection
 # - File types for categorization
 #
-version: 5.2.6
-generated_at: "2026-05-17T19:14:46.622Z"
+version: 5.2.7
+generated_at: "2026-05-18T04:18:43.763Z"
 generator: scripts/generate-install-manifest.js
 file_count: 1128
 files:
@@ -1297,7 +1297,7 @@ files:
     type: data
     size: 9590
   - path: data/entity-registry.yaml
-    hash: sha256:230377d843294363f6214266407437522d128d3ccd870316afdfdaa1ba0f7371
+    hash: sha256:f24c73354afaf968a0430a2bca6d7e1f46b863eb2edc08eef9393e556f581323
     type: data
     size: 575594
   - path: data/learned-patterns.yaml
@@ -3697,7 +3697,7 @@ files:
     type: monitor
     size: 818
   - path: package.json
-    hash: sha256:d1cc33f580e68ec3c3e5dfb95f152852d587472d086d55fa643e8aabd0c29f77
+    hash: sha256:8335dc568cb25279628e511f1a2ef4d10f0573e843df0c8ec0829235e0f7c004
     type: other
     size: 1445
   - path: product/checklists/accessibility-wcag-checklist.md

.aiox-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiox-squads/core-internal",
-  "version": "5.2.6",
+  "version": "5.2.7",
   "description": "Internal package manifest for AIOX framework — declares runtime dependencies consumed by scripts under .aiox-core/. This is NOT published independently; it ships inside @aiox-squads/core (the top-level package). Kept name-distinct from the parent (`-internal` suffix) to avoid npm registry confusion. Version follows the parent package.",
   "private": true,
   "main": "index.js",

CHANGELOG.md

@@ -5,6 +5,45 @@ All notable changes to Synkra AIOX will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.2.7] - 2026-05-18
+
+### Fixed
+
+- **Installer respects `--ci` / `--yes` / `--skipPrompts` flags at the CLAUDE.md merge prompt** — non-interactive runs no longer block waiting for keyboard input (#739 Bug 1, #750).
+  - Root cause: `generateIDEConfigs()` callsite never forwarded CI flags down to `promptFileExists()`. The wizard parsed the flags but the prompt layer never saw them.
+  - Fix: new `isNonInteractive(options)` helper checks (in precedence order) explicit options → CI env → `AIOX_NON_INTERACTIVE` env → `!stdout.isTTY`. Plumbing added at `index.js → generateIDEConfigs() → promptFileExists()`. Default choice when non-interactive matches the interactive flow's landing default (brownfield + canMerge → `merge`; else → `backup`).
+  - Regression coverage: 16 new tests in `tests/installer/ide-config-generator-ci-flags.test.js`. Full installer suite: 275/275 pass.
+- **Legacy path references aligned with current `.aiox-core/` directory layout** — `@po *validate-story-draft` and downstream story-flow tasks no longer reference paths that don't exist (#741, #747).
+  - 70 substitutions across 17 authored files mapping `aiox-core/{templates,checklists,agents,tasks,workflows,agent-teams}/<X>` → `.aiox-core/{product/templates,product/checklists,development/agents,development/tasks,development/workflows,development/agent-teams}/<X>`. Negative-lookbehind regex `(?<![\.])` preserved already-dotted references.
+- **IDS `extractPurpose()` priority chain rewritten** — registry purpose fields no longer pick up garbage from body text or example transcripts (#748).
+  - Removed body-level regex that matched any `description:`/`purpose:`/`summary:` occurrence (false-positive on installer example output).
+  - New strict priority: frontmatter `description:` → `## Purpose` → `## Overview` → `# Title` → generic `Entity at <path>` fallback. Each strategy anchored to its respective markdown construct.
+  - Added `syncSelfRegistryEntry()` writing sentinel `sha256:<self-reference>` for the registry's own record (avoids circular hash) and using `metadata.lastUpdated` as single source for `lastVerified`.
+- **IDS placeholder filter (`looksLikePlaceholder()`)** — 16 garbage purposes (`{Brief description...}`, `{{TASK_TITLE}}`, `${context.componentName}`, etc) no longer appear in `entity-registry.yaml` (#749).
+  - Detects whole-string single placeholders, leading-token placeholders, and dominant-interpolation (>30%) cases. Conservative on real prose containing legitimate `{}` syntax.
+  - Wired into all 4 strategies in the priority chain; falls through to `Entity at <path>` when every strategy yields a placeholder. 12 new unit tests covering positive + negative cases.
+- **Internal `.aiox-core/package.json` rebranded** — `@aiox-fullstack/core@4.31.1` → `@aiox-squads/core-internal@5.2.7` (`private: true`; phantom peerDependencies dropped) (#739 Bug 2, #746).
+  - The `-internal` suffix is defensive disambiguation: keeps the internal manifest name-distinct from the surface package for tooling that resolves by name (`npm ls`, lockfile resolution, dependency graphs).
+  - New `scripts/validate-aiox-core-namespace.js` (5-rule gate: file exists, name ends with `-internal`, `private: true`, version matches root, no `@aiox-fullstack/*` peers) wired into `validate:publish` so future drift is blocked before tag push.
+
+### Added
+
+- `docs/guides/installation-troubleshooting.md` **Issue 10** — install-side troubleshooting for `Installed Pro artifact did not create node_modules/@aiox-squads/pro`, with 3 OS variants (macOS/Linux/Windows). Two-tier recovery: simple retry first, then cache cleanup + residual install removal if state is fouled (#745).
+- `docs/guides/aiox-pro-access.md` — explicit entry in "Erros comuns" linking to Issue 10 (#745).
+- `.aiox-core/development/tasks/publish-npm.md` + `.aiox-core/development/tasks/release-management.md` converted to slim wrappers pointing at canonical `docs/guides/release-procedure.md` SOP (net −979/+108 lines; single source of truth) (#745).
+- `.aiox-core/development/agents/devops.md` — "Release Procedure (NON-NEGOTIABLE Reference)" section directs release/push/publish invocations to the SOP (#745).
+- `scripts/validate-aiox-core-namespace.js` — 5-rule namespace drift gate enforcing `-internal` suffix, `private: true`, version-match-root, no `@aiox-fullstack/*` peers, manifest exists. Wired into `validate:publish` (which `prepublishOnly` chains) (#746).
+
+### Changed
+
+- `docs/guides/release-procedure.md` — Version bump section now lists **5 sites** (was 4): root `package.json`, `compat/aiox-core/package.json` (version + dep), `packages/installer/package.json` (when installer src changed), `.aiox-core/package.json` (lockstep with root per `validate-aiox-core-namespace.js`), `package-lock.json` refresh. The 5th site became mandatory in 5.2.7 — first release publishing under the new namespace-drift gate.
+
+### Notes
+
+- Pipeline hardening from PR #744 (race condition fix between `publish_legacy_aiox_core` and `publish`, smoke timeout 90s→240s with dual visibility check, structured notify summary distinguishing hard vs soft fails, Windows path escape via `WORKSPACE_DIR` env var in `installer-smoke-matrix.yml`) is already in production since 5.2.6 — this release does not change those workflows.
+- The `--ci`/`--yes` fix (Bug 1) directly benefits students running `npx aiox-core@latest install --ci --yes --merge --ide claude-code` in CI/CD pipelines. The `printf '\n\n\n' | npx ...` workaround is no longer required.
+- `@aiox-squads/installer@3.3.6` ships alongside this release (PR #750 touched `packages/installer/src/wizard/`). `@aiox-squads/aiox-install` and `@aiox-squads/aiox-pro-cli` are unchanged.
+
 ## [5.2.6] - 2026-05-17
 
 ### Fixed

compat/aiox-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aiox-core",
-  "version": "5.2.6",
+  "version": "5.2.7",
   "description": "Compatibility wrapper for @aiox-squads/core.",
   "license": "MIT",
   "bin": {
@@ -15,7 +15,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@aiox-squads/core": "5.2.6"
+    "@aiox-squads/core": "5.2.7"
   },
   "engines": {
     "node": ">=18"

docs/guides/release-procedure.md

@@ -33,16 +33,21 @@ Block the release if any of these are red.
 
 ## Version bump (T-5 minutes)
 
-Bump **all four** version sites in lockstep. Mismatches cause silent publish
-failures that only show up in the smoke tests.
+Review **all five** version sites during release prep. The root surface, the
+internal manifest, and the compat wrapper MUST stay in lockstep at the same
+version. `packages/installer/package.json` is bumped **only** when installer
+source changed — not on every release. Mismatches cause silent publish failures
+that show up in the smoke tests OR are caught by
+`validate-aiox-core-namespace.js` (wired into `validate:publish`).
 
 | File | What to bump |
 |---|---|
-| `package.json` | `version` (scoped `@aiox-squads/core`) |
+| `package.json` | `version` (scoped `@aiox-squads/core`) — single source of truth |
 | `compat/aiox-core/package.json` | `version` AND `dependencies["@aiox-squads/core"]` (must equal `version`) |
 | `packages/installer/package.json` | `version` (patch bump if installer changed; otherwise leave) |
+| `.aiox-core/package.json` | `version` MUST match root `package.json` version (lockstep per `scripts/validate-aiox-core-namespace.js` rule 4 — added in 5.2.7 after the namespace drift incident, Story #739 Bug 2). The internal manifest is not separately published but ships inside the parent surface |
 | `package-lock.json` | Refresh via `npm install --package-lock-only --ignore-scripts` |
-| `CHANGELOG.md` | New entry at top under `## [X.Y.Z] - YYYY-MM-DD` using Keep-a-Changelog sections (`### Fixed`, `### Added`, `### Notes`) |
+| `CHANGELOG.md` | New entry at top under `## [X.Y.Z] - YYYY-MM-DD` using Keep-a-Changelog sections (`### Fixed`, `### Added`, `### Changed`, `### Notes`) |
 
 If `entity-registry.yaml` or `install-manifest.yaml` change during the commit
 hook run, include them — they are SOT files and the pre-commit hook

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiox-squads/core",
-  "version": "5.2.6",
+  "version": "5.2.7",
   "description": "Synkra AIOX: AI-Orchestrated System for Full Stack Development - Core Framework",
   "bin": {
     "aiox": "bin/aiox.js",

packages/installer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiox-squads/installer",
-  "version": "3.3.5",
+  "version": "3.3.6",
   "description": "AIOX Installer - Automated setup wizard for AIOX projects (greenfield & brownfield)",
   "main": "src/index.js",
   "bin": {